A new mobile security report revealed that both banking Trojans and cryptocurrency malware grew by at least 60 percent in 2017, suggesting that cybercriminals are exploring new ways to maximize their illicit profits.
Mobile Security Threats on the Rise
In its “Mobile Threat Report” for Q1 2018, McAfee attributed the rise in mobile banking Trojans to various threats, such as Marcher malware, which impersonated legitimate apps to victimize millions of Google Play users. Another was MoqHao, a menace that spread via SMS to prey upon users who own an account at one of the major Korean banks.
Both of these threats failed to live up to the innovation of LokiBot, however. SfyLabs discovered that this Trojan activated a ransomware module whenever a user attempted to disengage its administrative rights.
Banking Trojans weren’t the only type of malicious mobile software that grew in 2017. McAfee found that cryptocurrency malware increased by 70 percent, including a 5 percent increase in activity on Google Play. The security firm also observed an 80 percent rise in bitcoin mining malware.
Big Money in Mobile Malware
These increases in banking Trojans and cryptocurrency malware point to important changes in the mobile security threat landscape. According to the report, 16 million users suffered mobile malware infections in the third quarter of 2017. That’s double the number observed by researchers a year earlier. Russia, China and South Korea suffered the greatest share of those infections.
The fact that cybercriminals are ramping up their mobile attacks underscores their growing desire to make big money. They are embracing new techniques, such as botnet ad fraud, pay-per-download distribution scams and malicious cryptominers. With these new tactics, bad actors can generate much more money from their malicious activity than they could years ago.
The report estimated that the highest-paid malware campaign could net cybercriminals between $100,000 and $300,000 in 2010. But today’s fraudsters can potentially earn between $1 million and $2 million with a “full-fledged campaign.”
Organizations need to do more to protect their employees against mobile malware. As always, that starts with employee security awareness training, strong identity and access management, and effective oversight of corporate devices.